Windows EFS
Microsoft EFS (Encrypted File System) can be used in combination with SMB and WebDAV. With SMB on network shares it makes not much sense (see my other notes) because of the strange implementation of using server side profiles and keys. But on local disks or with WebDAV on network filestores it's a great security enhancement out-of-the-box.
But there are a lot of issues and caveats you have to know when you want to deploy EFS in an enterprise infrastructure. Today I found the "ParanoidMike" blog which is a great resource for some of EFS related question:
EFS Certificate Updater
EFS and SYSKEY backgrounder
Why EFS makes no sense on servers
Hello. I have a question.
I was Windows 7 Professional. The Professional/Business and higher editions of Windows since Windows XP version have the EFS (Encrypting File System) feature as part of the operating system. This is the main reason why I will not go lower in using/purchasing Windows editions than the Windows Professional/Business line editions.
Okay, I have an issue. I have a PDF file and I placed inside the a folder that happens to be EFS encrypted that when I moved/copied the PDF file into the encrypted folder the PDF file automatically became encrypted itself. The text or file name turns from the normal black type to the green type indicating that it is encrypted. Good, I say. It is not secure. Now, here is the issue. I have both the free version (limited version) of Adobe Reader installed (v.9.4) and a program called Nuance PDF Viewer Plus that also is a more advanced PDF application. For your information, I have set the PDF file Associate a file type or protocol with a program to the Nuance PDF Viewer Plus to open and view my PDF files.
Now when I open the PDF file in that EFS encrypted file, I have an issue. As the Nuance PDF Viewer Plus opens the encrypted PDF file, I get a message or dialog box in the middle of the screen stating, Access denied. Okay, I see this is Windows EFS encryption is working, but how exactly is it working? Shouldn't I have access to it on my OWN SYSTEM??? Okay, I go ahead and open this same PDF file with my Adobe Reader. Again, I get a similar message that states, There was an error opening this document. Access denied.. So I see I cannot open this PDF document that Windows EFS encrypted.
First, for your information, I did not password protect the PDF file with a more advanced PDF editing software that allows for password protection of PDF documents. So there is no PDF password protection on this Windows EFS encrypted PDF file.
Second, WHEN this PDF file it was moved/copied into this EFS encrypted folder was performed in the SAME user account of the SAME copy of Windows 7 Professional. Being on the SAME operating system with the SAME user account, even though my files and folders are EFS encrypted, shouldn't I be able to still access these any of these very EFS encrypted files and folders?
Questions: So, how do I open this PDF file that was encrypted by Windows 7 Professional EFS? What is the procedure? If it requires some advanced steps, please explain the steps in detail.
So what I am looking to understand:
1. Why am I having issues? Please explain.
2. How do I resolve it? Please explain. Do have to only be in my user account of the same Windows operating system I originally created the EFS file or folder in order to open an Windows EFS encrypted file? Please explain.
The Encrypting File System or EFS is a important component of the NTFS file system on Windows XP Professional, and Windows Server 2003. EFS enable transparent decryption and encryption of files by utilizing advanced, standard cryptographic algorithms. Any program or individual that doesn't possess the correct and appropriate cryptographic key cannot read the encrypted information and data. Encrypted files can be safely protected even from those who have gain physical possession of the computer that the files are stored on. Even persons who are legally authorized to access their PC and its file system cannot view the information and data.
While other defensive tactics and strategies should be utilized and used, and encryption isn't the correct answer and countermeasure for every threat, encryption is a very powerful plus to any defensive strategy. EFS is the standard built-in file encryption tool for Windows file systems. Once a folder or files are encrypted with EFS, only the private EFS key of the user account that encrypted it will be able and allowed to decrypt it. If something happens to the PC system and the encryption certificate or key are forgotten or lost, the data will be irrecoverable. To ensure file continued access to their own encrypted files, they should perform the standard steps to export the EFS certificate and private key and store it on a backup disk or floppy disk, CD or DVD for future use and reference.
However, every protection and defensive weapon, if used unnecessary and incorrectly, carries the potential for problem and harm. EFS must be checked and understood, implemented appropriately, and must be managed effectively to ensure that experience, the experience of those to whom given and provide support, and the data they wish to protect aren't harmed. Just making file protection as easy as it gets.